chore(deps): update quay.io/argoproj/argocd docker tag to v3

[vshn-renovate]

This PR contains the following updates:

Package	Update	Change
quay.io/argoproj/argocd	major	v2.13.8 -> v3.1.1

---

Release Notes

argoproj/argo-cd (quay.io/argoproj/argocd)

v3.1.1

Compare Source

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.1.1/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.1.1/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• b22566d: fix(lua): allow actions to add items to array (#​24137) (@​agaudreault)
• eb72a0b: fix(server): Send Azure DevOps token via git extra headers (#​23478) (#​23631) (#​24223) (@​rumstead)
• fdd0991: fix(util): Fix default key exchange algorthims used for SSH connection to be FIPS compliant (#​24086) (cherry-pick 3.1) (#​24166) (@​anandf)
• c140eb2: fix: resolve argocd ui error for externalSecrets, fixes #​23886 (#​24232) (#​24236) (@​raweber42)

Other work

• a0f0653: chore: add oci env vars to manifests (#​24113) (cherry-pick 3.1) (#​24153) (@​blakepettersson)
• 70dde2c: chore: cherry pick #​24235 to release-3.1 (#​24238) (@​FourFifthsCode)

Full Changelog: argoproj/argo-cd@v3.1.0...v3.1.1

v3.1.0

Compare Source

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.1.0/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.1.0/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Features

• 6047e91: feat(AppProject): Add sync window description (#​20766) (@​speedfl)
• 999dbb2: feat(UI): add enabled field to explicitly set in automatedSync in SyncPolicy (#​22482) (@​aali309)
• 111da39: feat(actions): parametrized actions to scale workloads (#​15505) (#​20097) (@​ratulbasak)
• 76a63a1: feat(api): protect static assets endpoint from symlink traversal (#​22936) (@​crenshaw-dev)
• 99faf82: feat(appset): add target branch support for bitbucket cloud pull request generator (#​22402) (@​mihallis)
• 64198e8: feat(ci): don't cancel-in-progress on master (#​23392) (@​crenshaw-dev)
• 6cf2961: feat(cli): Add Plugin Support to the Argo CD CLI (#​20074) (@​nitishfy)
• d14ba14: feat(cli): Adding whoami alias (#​23385) (@​christianh814)
• 7d66044: feat(health): Implement spinkube SpinApp CRD health checks (#​21896) (@​lukepatrick)
• 65464d8: feat(health): OpenTelemetryCollector CRD Healthcheck (#​23156) (@​savanipoojan78)
• 8f1f5c7: feat(health): add Logstash resource customization (#​22028) (@​fprovencherdrw)
• 96039be: feat(health): add Rabbitmq topology resource customizations (#​22066) (@​fprovencherdrw)
• 9149021: feat(health): add crossplane and upbound health checks (#​21479) (#​22919) (@​crenshaw-dev)
• e578b85: feat(health): add kyverno Policy resource customization (#​21552) (@​marckhair)
• 7224a15: feat(helm): upgrade to 3.18.3 (cherry-pick #​23618) (#​23620) (@​gcp-cherry-pick-bot[bot])
• 8eaccb7: feat(helm): upgrading helm to 3.18.4 (cherry-pick #​23724) (#​23731) (@​gcp-cherry-pick-bot[bot])
• 81ae77a: feat(hydrator): commit tracing (#​19441) (#​23361) (@​crenshaw-dev)
• d9ef10a: feat(hydrator): handle sourceHydrator fields from webhook (#​19397) (#​22485) (@​alexymantha)
• 563d45b: feat(kustomize): upgrade to 5.7.0 (#​23619) (#​23625) (@​crenshaw-dev)
• 2dafcba: feat(ui): add keydown event to the pod dropdown menu (#​20996) (@​vivian-xu)
• 3f3ac06: feat(ui): add toggle for fullname of resources in application-details-tree (#​20812) (@​surajyadav1108)
• bb37b10: feat(ui): allow to sort by age in Pod-view (#​20783) (@​surajyadav1108)
• 0e95193: feat(ui): allows more convenient sorting of repository. (#​19829) (@​bianbbc87)
• 30742f6: feat(ui): disable select not running pod and bring back arrow to selected pod (#​21576) (@​linghaoSu)
• 9675487: feat(ui): integrate Progressive Sync feature (#​22781) (@​aali309)
• eb794b7: feat(ui): set validate=false for "disable autosync" request during rollback via ui (#​22898) (#​23101) (@​dlemfh)
• ceec669: feat(ui): support delete all expired token in project roles (#​21782) (@​linghaoSu)
• 2fbace3: feat(webhook): Fixed manifest-generate-paths annotation support for monorepos in BitBucket (#​21811) (@​anandf)
• 964f269: feat: Add GitHub API rate limit metrics (#​22864) (@​reggie-k)
• 18ce5c2: feat: Add images to resources in sync result #​20896 (#​20954) (@​Aaron-9900)
• 6d7e75d: feat: Add link to get the list of applications of a cluster/project (#​21561) (@​almoelda)
• ce4b7a2: feat: Contour HTTPProxy health check support for issue # 22504 (#​22596) (@​gregbarasch)
• 2bd2488: feat: Enable SkipDryRunOnMissingResource sync option on Application level (#​22679) (@​pasha-codefresh)
• 5a3a104: feat: Implement grafana-operator Dashboard and Folder CRD health checks (#​22493) (@​afarbos)
• a2152a1: feat: Implement healthcheck gateway api (#​20986) (#​22855) (@​chansuke)
• 2c53861: feat: Polish off UI changes for OCI support (#​21685) (#​22410) (@​keithchong)
• d3223a8: feat: add Fallback condition to KEDA ScaledObject health assessment (#​22844) (@​rickbrouwer)
• dc1d148: feat: add SSA field manager migration options (#​23337) (@​pjiang-dev)
• dd5a878: feat: add ability to exclude files when using git file generator (#​22734) (@​nitishfy)
• f4edcf7: feat: add custom health check for CloudNativePG (#​22802) (@​sxd)
• 432a0cd: feat: add enable field for automatedSync (#​21999) (@​anandrkskd)
• 98ca411: feat: add metric for sync durations(#​11675) (#​18474) (@​Jack-R-lantern)
• f763b2a: feat: add pause action for argo-rollouts #​20505 (#​20506) (@​sedflix)
• 19669d2: feat: add repository_id to AppSet generators (#​15820) (#​22416) (@​geichelberger)
• ec9b43f: feat: implement custom resource action skip-current-step for argo rollouts (#​23025) (@​reggie-k)
• 4a15925: feat: improve Helm documentation (#​22859) (@​sabre1041)
• ddb1021: feat: improve numa actions (#​22835) (@​dpadhiar)
• 18c4d9d: feat: oci support (Beta) (#​18646) (@​blakepettersson)
• 00ee32f: feat: optionally propagate node labels to application pod view (#​15274) (#​23260) (@​msoderberg)
• 5091f9a: feat: remove suspended state from numaproj crds (#​23359) (@​dpadhiar)
• d284b15: feat: support gitea PR labels filter in appset PR generator (#​21115) (#​21148) (@​livelxw)

Bug fixes

• f26b7cd: fix(ApplicationSet): Check strategy type to verify it's a progressive sync (#​22563) (@​fcrespofastly)
• 274e918: fix(appcontroller): if a history limit is negative, automatically converted to 0 (#​22036) (@​kingbj940429)
• 25dc960: fix(applicationset_controller): requeue by ApplicationStatus changes (#​23043) (@​dshmelev)
• f7590fa: fix(appset): Add token to enterprise client (#​23240) (#​23455) (@​lets-call-n-walk)
• 66d06c0: fix(appset): When Appset is deleted, the controller should reconcile applicationset #​23723 (cherry-pick ##​23823) (#​23835) (@​rumstead)
• 7a06400: fix(appset): add default retry limit for operations triggered via RollingSync (#​20428) (#​23335) (@​mikeshng)
• e9ae886: fix(ci): get correct previous version, fail workflow if not (#​22376) (@​crenshaw-dev)
• 9c2ffb7: fix(ci): handle major versions in compatibility table generator (#​22370) (@​crenshaw-dev)
• 9a8ec4a: fix(ci): use tags instead of branches (#​22372) (@​crenshaw-dev)
• 3f90f99: fix(cli): Fix for removing auto generated tag for applicationset command (#​22446) (@​anandf)
• 0dfdb0a: fix(cli): Prevent Get & Sync from Hanging on Invalid Application Spec (#​21702) (@​almoelda)
• a223356: fix(controller): always set health.status.lastTransitionTime (#​22665) (#​22666) (@​crenshaw-dev)
• 75f7016: fix(controller): get commit server url from env (cherry-pick #​23536) (#​23541) (@​gcp-cherry-pick-bot[bot])
• d69639a: fix(controller): impersonation with destination name (#​23309) (cherry-pick #​23504) (#​23519) (@​gcp-cherry-pick-bot[bot])
• 45a8c68: fix(controller): only update lastTransitionTime when needed (#​23018) (@​crenshaw-dev)
• 320f46f: fix(darwin): remove the need for cgo when building a darwin binary on linux (cherry-pick #​23507) (#​23526) (@​gcp-cherry-pick-bot[bot])
• df5ff1f: fix(doc): Fix typo in SSA doc (#​23421) (@​pjiang-dev)
• 73f68af: fix(docs): Fix UI port in E2E docs (#​22881) (@​olivergondza)
• acd8844: fix(docs): upgrading 3.0 docs (#​22891) (@​jheyduk)
• 8ede222: fix(goreleaser): add darwin with CGO enabled and remove static to gorelease (#​23457) (@​rumstead)
• 0b8d018: fix(goreleaser): add darwin with CGO enabled to goreleaser (#​23433) (@​rumstead)
• bd30eea: fix(haproxy): setting maxconn in haproxy config (#​15319) (#​18283) (@​timgriffiths)
• 36cc2d1: fix(health): CRD health check message (#​23690) (cherry-pick #​23691) (#​23738) (@​gcp-cherry-pick-bot[bot])
• e9483a6: fix(health): handle nil lastTransitionTime (#​22897) (#​22900) (@​crenshaw-dev)
• 91e5f95: fix(hydrator): incorrect json tag (#​23432) (@​crenshaw-dev)
• 3bbbac4: fix(hydrator): increase max msg size (#​23190) (@​crenshaw-dev)
• 37f2793: fix(hydrator): omit Argocd- trailers from hydrator.metadata (cherry-pick #​23463) (#​23621) (@​gcp-cherry-pick-bot[bot])
• 96fd061: fix(hydrator): split commit subject and body, make author one string (#​23389) (@​crenshaw-dev)
• 0484f9f: fix(manifest): using wrong container registry for non-ha redis (#​23114) (@​agaudreault)
• 9f18ff1: fix(metrics): Cherrypick grpc stats fix release 3.1 (#​23890) (@​pbhatnagar-oss)
• 36f91a0: fix(metrics): populate dest_server label (#​23246) (#​23269) (@​crenshaw-dev)
• d4bdabd: fix(server): Propagate useAzureWorkloadIdentity flag from during repo validation (#​23348) (#​23358) (@​mikebordon)
• 7fda067: fix(server): avoid unnecessary claims restrictions (#​22973) (#​23202) (@​crenshaw-dev)
• 5b21f98: fix(server): infer resource status health for apps-in-any-ns (#​22944) (@​crenshaw-dev)
• 1cbd28c: fix(server): make parameterized resource actions backwards-compatible (cherry-pick #​23695) (#​23709) (@​gcp-cherry-pick-bot[bot])
• 7915002: fix(server): race condition in revoked token logic (#​23311) (#​23312) (@​crenshaw-dev)
• 6142c5b: fix(sync): auto-sync loop when FailOnSharedResource (#​23357) (#​23640) (@​agaudreault)
• 6ef9713: fix(test): #​23137 removed left over file that breaks subsequent make test run. (#​23138) (@​EricFortin)
• db6ece9: fix(test): broken e2e test (#​22975) (@​crenshaw-dev)
• 6174b94: fix(test): race condition in kubectl metrics (#​23382) (#​23383) (@​crenshaw-dev)
• 1d09c8c: fix(tests): race condition creating the sync id (#​23481) (@​agaudreault)
• 109cd6c: fix(tls): validate RSA keys before marshaling (#​23295) (@​thevilledev)
• 38e7a03: fix(ui): Added tooltip for buttons in narrow window (#​20886) (@​surajyadav1108)
• 8fde8d0: fix(ui): Improve light/dark theme selector label (#​22958) (@​dnrce)
• bde7bcf: fix(ui): avoid spurious error on hydration (#​22506) (#​22711) (@​crenshaw-dev)
• fdb0350: fix(ui): fix bearerToken validate in helm connect page (#​22791) (@​linghaoSu)
• 04186aa: fix(ui): fix podGroup expansion background (#​22279) (@​linghaoSu)
• 590d0cd: fix(ui): make Name column wider (#​21080) (#​21375) (@​korsar182)
• f4e2c6e: fix(ui): replace current spinning webfont icon with svg icons (#​21012) (@​surajyadav1108)
• 814a24e: fix(ui): resolve refresh page issue with multi system extensions (#​22775) (@​imwithye)
• 401e835: fix(ui): use correct monaco editor config for correct behavior (#​22421) (@​linghaoSu)
• e6065b8: fix(updateAppsetFinalizers): Update Finalizers in addition to other metadata updates when updating Appsets (#​23006) (@​sangdammad)
• 3e7625a: fix(webhook): Fix panic when web URL string is empty in webhook payload (#​23042) (@​anandf)
• 6bee96c: fix: #​20183 preserve syncOptions when rolling back from the UI (#​21871) (@​alexef)
• 76f80b3: fix: #​22879 override default variables in Makefile when your env is local Mac (#​23182) (@​daengdaengLee)
• 531b79a: fix: #​23041 Add resource support to 'argocd proj role add-policy/remove-policy' (#​23213) (@​mason-liu)
• c0c6abe: fix: #​23100 Change workloadidentity token cache expiry based on token expiry. (#​23133) (@​jagpreetstamber)
• 1a25d7c: fix: Account for batch event processing in e2e tests (#​22356) (@​andrii-korotkov-verkada)
• edf3683: fix: Add metadata labels to all NetworkPolicy resources (#​23313) (@​philippemerle)
• 895dcf7: fix: Allow ClusterAPI MachinePool scaling to be considered Healthy (#​22040) (@​mtougeron)
• c73796d: fix: Always create manual long lived token (#​19970) (@​VannTen)
• d22e28a: fix: AppSet PullRequest and SCM generators get 401 from GitHub without tokenRef (#​22737) (@​reggie-k)
• b4fc122: fix: CVE-2025-26791 upgrading redoc dep to 2.4.0 to avoid DOMPurify b… (#​21998) (@​nmirasch)
• 4a987dd: fix: Check for semver constraint matching in application webhook handler (#​21634) (#​21648) (@​eadred)
• 4905876: fix: Disable ESO refresh/push custom actions when they would do nothing (#​22305) (@​crabique)
• b0d00d5: fix: Enable service account token automount for haproxy (#​22226) (#​22353) (@​andrii-korotkov-verkada)
• cde5b4b: fix: Increase Scan count and move Scan outside of mutex lock to avoid slow calls timing out (#​17645) (#​21926) (@​sethgupton-mastery)
• ea97dec: fix: KubeVersion passed to helm template is incorrectly (#​22650) (@​sivchari)
• c215dbf: fix: OCI client, avoid calling tags/list if revision is not a constraint #​23580 (cherry-pick #​23581) (#​23582) (@​gcp-cherry-pick-bot[bot])
• b2ad012: fix: Only port-forward to ready pods (#​10610) (#​22794) (@​mikebryant)
• 992ee25: fix: Race condition in nativeGitClient.LsFiles (issue #​21754) (#​22878) (@​magat)
• 8fd6119: fix: Race condition occurs during initial sharing (#​22696) (@​kahou82)
• dd675fe: fix: UI error with ApplicationSet in any namespace (cherry-pick #​23601) (#​23604) (@​gcp-cherry-pick-bot[bot])
• 6340e7e: fix: UI log viewer 'Show logs since a given time' filed has no effect bug #​22330 (#​22331) (@​ianyc)
• 1c1c176: fix: kustomize edit add component check (#​24100) (cherry-pick 3.1) (#​24102) (@​blakepettersson)
• 722da4e: fix: add cooldown to prevent resetting autoheal exp backoff preemptively (#​23057) (@​gdsoumya)
• 44fce0e: fix: add fatal timeout upgrade with SIGKILL to ARGO_EXEC_TIMEOUT (closes #​20785, #​18478) (#​22713) ( <>)
• 3ff30df: fix: add optional chaining before access to the targetRevision field (#​23397) (@​daengdaengLee)
• 95efc16: fix: add shellcheck and fix a few warnings (#​22569) (@​leshikus)
• aefa93f: fix: added tasks to upgrade Redis HA using renovate (#​22054) (@​afzal442)
• 299286d: fix: app tree parentRef response missing version info (#​22927) (@​hanxiaop)
• f03ffb3: fix: bump gitops-engine for ssd fix (#​23456) (@​pjiang-dev)
• 56c556e: fix: clarify applicationSet sync-policy (#​22888) (@​raweber42)
• 61b3ea1: fix: context cancellation handling (#​22824) (@​sivchari)
• 5002f8a: fix: disable golang caching on releases to harden against cache poisoning (#​22699) (@​GrantBirki)
• 76d1772: fix: do not exclude APIService resources (#​22586) (@​agaudreault)
• 01a882d: fix: do not fail on manifest-like yaml #​21934 (#​22043) (@​CefBoud)
• 8c3c778: fix: do not normalize resource tracking on live crds (#​22722) (@​blakepettersson)
• 8bfb4f4: fix: fixing broken md link (#​22517) (@​xvirgov)
• f6f10c0: fix: handle annotated git tags correctly in repo server cache (#​21771) (@​aali309)
• 26c63b9: fix: helm GetTags cache writing (cherry-pick #​23865) (#​23952) (@​gcp-cherry-pick-bot[bot])
• 6fe5ec7: fix: improves the ui message when an operation is terminated due to controller sync timeout (cherry-pick #​23657) (#​23672) (@​gcp-cherry-pick-bot[bot])
• d171179: fix: invalid version for 'k8s.io/[email protected]' (#​22434) (@​hua-ri)
• 4a7e581: fix: kustomize components + monorepos (cherry-pick #​23486) (#​23540) (@​gcp-cherry-pick-bot[bot])
• 49514c9: fix: minor oci fixes (#​23434) (@​blakepettersson)
• f532299: fix: parse project with applicationset resource (#​23252) (@​blakepettersson)
• d4a20e4: fix: prevent rootpath duplication in OIDC redirect URLs, fixes #​21857 #​20790 #​12195 (#​22254) (@​Diasker)
• 6e972e4: fix: properly handle shutdown signal for admin dashboard (#​23231) (@​blakepettersson)
• 0707bff: fix: remove default spec.preserveUnknownFields ignoreDifference for CRD (#​22948) (@​mikutas)
• db9c82a: fix: remove project from cache key for project scoped credentials (#​22712) (@​pjiang-dev)
• e72ebb0: fix: respect delete confirmation for argocd app deletion (#​22657) (@​nitishfy)
• f4e12ad: fix: revert "added tasks to upgrade Redis HA using renovate (#​22054)" (#​23068) (@​crenshaw-dev)
• a9a0c7b: fix: revert kubeVersion change to preserve trailing + (cherry-pick #​24066) (#​24104) (@​agaudreault)
• [be3efbd](https://redirect.github.com/arg